nixos/buildkite-agents: fix race-condition when installing secrets
commit503b93754278a661391c868544085bcf3713fa89
authorJörg Thalheim <joerg@thalheim.io>
dateSat 1 May 2021, 18:36 (6 years ago)
parent4e55c8b
nixos/modules/services/continuous-integration/buildkite-agents.nix+1−2
@@ -238,8 +238,7 @@ in
238238 in
239239 optionalString (cfg.privateSshKeyPath != null) ''
240240 mkdir -m 0700 -p "${sshDir}"
241− cp -f "${toString cfg.privateSshKeyPath}" "${sshDir}/id_rsa"
242− chmod 600 "${sshDir}"/id_rsa
241+ install -m600 "${toString cfg.privateSshKeyPath}" "${sshDir}/id_rsa"
243242 '' + ''
244243 cat > "${cfg.dataDir}/buildkite-agent.cfg" <<EOF
245244 token="$(cat ${toString cfg.tokenPath})"